@yemi33/minions 0.1.2381 → 0.1.2383

package/engine.js

@@ -34,14 +34,20 @@ const shared = require('./engine/shared');
 const { exec, execAsync, execSilent, runFile, ts, ENGINE_DEFAULTS,
   WI_STATUS, DONE_STATUSES, WORK_TYPE, PLAN_STATUS, PRD_ITEM_STATUS, PRD_MATERIALIZABLE, PR_STATUS, REVIEW_STATUS, DISPATCH_RESULT, AGENT_STATUS,
   FAILURE_CLASS, resolvePollFlag } = shared;
-const { resolveRuntime } = require('./engine/runtimes');
-const { assertStaleHeadOk, preApproveWorkspaceMcps } = require('./engine/spawn-agent');
+const {
+  resolveRuntime,
+  resolveInvocationOptions,
+  buildSpawnFlags,
+  prepareWorkspace,
+} = require('./engine/runtimes');
+const { assertStaleHeadOk } = require('./engine/spawn-agent');
 // P-1d8f0b93 — fleet ACP worker pool + its child_process-shaped facade.
 // NOTE: engine/agent-worker-pool.js is a DIFFERENT module from the
 // dashboard's single-tab CC pool (engine.js must never import that one —
 // see the cc-tab-pool wiring regression guard test).
 const agentWorkerPool = require('./engine/agent-worker-pool');
 const { PooledAgentProcess } = require('./engine/pooled-agent-process');
+const { normalizeExecutionModel } = require('./engine/execution-model');
 const adoGitAuth = require('./engine/ado-git-auth');
 const queries = require('./engine/queries');
 const dispatchEvents = require('./engine/dispatch-events');
@@ -436,22 +442,7 @@ function _maxTurnsForType(type, engineConfig = {}) {
 // ─── Runtime adapter integration (P-2a6d9c4f) ────────────────────────────────
 
 function _buildAgentSpawnFlags(runtime, opts = {}) {
-  if (runtime && typeof runtime.buildSpawnFlags === 'function') return runtime.buildSpawnFlags(opts);
-  const caps = (runtime && runtime.capabilities) || {};
-  const flags = ['--runtime', String(runtime?.name || 'claude')];
-  if (opts.maxTurns != null) flags.push('--max-turns', String(opts.maxTurns));
-  if (opts.model) flags.push('--model', String(opts.model));
-  if (opts.allowedTools) flags.push('--allowedTools', String(opts.allowedTools));
-  if (caps.effortLevels && opts.effort) flags.push('--effort', String(opts.effort));
-  if (caps.sessionResume && opts.sessionId) flags.push('--resume', String(opts.sessionId));
-  if (caps.budgetCap && opts.maxBudget != null) flags.push('--max-budget-usd', String(opts.maxBudget));
-  if (caps.bareMode && opts.bare === true) flags.push('--bare');
-  if (caps.fallbackModel && opts.fallbackModel) flags.push('--fallback-model', String(opts.fallbackModel));
-  if (opts.stream != null && opts.stream !== '') flags.push('--stream', String(opts.stream));
-  if (opts.disableBuiltinMcps === true) flags.push('--disable-builtin-mcps');
-  if (opts.reasoningSummaries === true) flags.push('--enable-reasoning-summaries');
-
-  return flags;
+  return buildSpawnFlags(runtime, opts);
 }
 
 function _runtimeLogger() {
@@ -603,10 +594,48 @@ function captureSessionIdFromStdoutChunk(agentId, dispatchId, branchName, runtim
         logger: _runtimeLogger(),
       });
     }
+
     return;
   }
 }
 
+function _runtimeModelFromOutputLine(runtime, line) {
+  if (!runtime || typeof runtime.parseOutput !== 'function') return null;
+  try {
+    return normalizeExecutionModel(runtime.parseOutput(String(line), { maxTextLength: 0 })?.model);
+  } catch {
+    return null;
+  }
+}
+
+function captureExecutionModelFromStdoutChunk(dispatchItem, dispatchId, runtime, procInfo, chunk, state) {
+  if (!procInfo || procInfo.executionModel || !chunk) return null;
+  const text = String(state.modelLineBuffer || '') + String(chunk);
+  const lines = text.split('\n');
+  state.modelLineBuffer = /[\r\n]$/.test(text) ? '' : (lines.pop() || '');
+  if (state.modelLineBuffer.length > 65536) state.modelLineBuffer = '';
+
+  for (const line of lines) {
+    const model = _runtimeModelFromOutputLine(runtime, line);
+    if (!model) continue;
+    procInfo.executionModel = model;
+    dispatchItem.executionModel = model;
+    try {
+      mutateDispatch((dispatch) => {
+        for (const section of ['pending', 'active']) {
+          const item = (dispatch[section] || []).find(entry => entry.id === dispatchId);
+          if (item) item.executionModel = model;
+        }
+        return dispatch;
+      });
+    } catch (err) {
+      log('warn', `Could not persist runtime model for ${dispatchId}: ${err.message}`);
+    }
+    return model;
+  }
+  return null;
+}
+
 function mergePendingSteeringEntries(...groups) {
   const merged = [];
   const seen = new Set();
@@ -905,16 +934,14 @@ function _isTransientGitNetworkError(err) {
 }
 
 // Wraps shellSafeGit(['fetch', ...]) with a single retry on transient
-// network errors. Preserves the pre-fix convention that fetch failures
-// are NON-fatal here: we log + swallow the terminal error so the caller
-// falls back to the local ref. The retry just gives transient errors one
-// shot to recover before that fallback kicks in — empirically eliminates
-// most "couldn't find remote ref" cascades downstream caused by a 0-second
-// network blip during the initial fetch.
+// network errors. Most existing callers keep the historical non-fatal
+// behavior and receive false on terminal failure. Callers that cannot safely
+// use a stale local ref (ordinary fresh-branch creation) pass throwOnFailure
+// so the terminal git error remains available for accurate classification.
 //
 // `args` is the array passed to git AFTER 'fetch' (e.g. ['origin', branch]).
 // `label` is a short string used in the log line for triage.
-async function _fetchWithTransientRetry(args, opts, label) {
+async function _fetchWithTransientRetry(args, opts, label, { throwOnFailure = false } = {}) {
   const _attempt = async () => shared.shellSafeGit(['fetch', ...args], opts);
   try {
     await _attempt();
@@ -930,6 +957,7 @@ async function _fetchWithTransientRetry(args, opts, label) {
       // incident. _redactBearer keeps any bearer header echoed in the failing
       // git command out of engine logs.
       log('warn', `git fetch ${label}: ${adoGitAuth.redactBearer(String(e.message || e))}`);
+      if (throwOnFailure) throw e;
       return false; // swallow non-transient — caller falls back to local ref
     }
     const transientMsg = adoGitAuth.redactBearer(String(e.message || e));
@@ -941,12 +969,32 @@ async function _fetchWithTransientRetry(args, opts, label) {
       return true;
     } catch (e2) {
       const retryMsg = adoGitAuth.redactBearer(String(e2.message || e2));
-      log('warn', `git fetch ${label}: retry also failed (${retryMsg}) — falling back to local ref`);
+      log('warn', `git fetch ${label}: retry also failed (${retryMsg})${throwOnFailure ? ' — surfacing error' : ' — falling back to local ref'}`);
+      if (throwOnFailure) throw e2;
       return false;
     }
   }
 }
 
+function _classifyFreshBaseFetchFailure(err) {
+  return adoGitAuth.isAdoAuthFailure(err)
+    ? FAILURE_CLASS.AUTH
+    : FAILURE_CLASS.NETWORK_ERROR;
+}
+
+async function _probeBranchLocally(rootDir, branchName, gitOpts) {
+  try {
+    await shared.shellSafeGit(
+      ['rev-parse', '--verify', '--quiet', `refs/heads/${branchName}`],
+      { ...gitOpts, cwd: rootDir, timeout: 10000 },
+    );
+    return true;
+  } catch (e) {
+    if (e?.code === 1) return false;
+    throw e;
+  }
+}
+
 // W-mr3tayu4 — thin wrapper around shared.removeStaleIndexLock. The age-gated
 // (>300000ms) stale-lock removal now lives in engine/shared.js so both the
 // worktree-add retry paths here and engine/live-checkout.js#prepareLiveCheckout
@@ -1430,15 +1478,15 @@ const _quarantinePathLocks = new Map();
 //      (Pure shared-branch callers pass quarantineOnUnsafe=false and DO NOT
 //      treat ahead-of-origin as dirty — that path's existing semantics are
 //      preserved. PR-targeted reused worktrees pass quarantineOnUnsafe=true
-//      and DO treat ahead-of-origin as unsafe because the underlying bug
-//      (#2996) was a 157-commit-ahead local branch.)
+//      and preserve clean strictly-ahead commits by pushing them before any
+//      quarantine fallback (#853).)
 //   3. If unsafe, decide:
 //      - Block (preserve dirty tree for inspection) when ANOTHER active
 //        dispatch claims the same branch (ownership ambiguity — NEVER
 //        quarantine, even when quarantineOnUnsafe=true).
-//      - Block when local commits exist that aren't on origin/<branch>
-//        (would lose unpushed work). When quarantineOnUnsafe=true,
-//        QUARANTINE instead: rename worktree to <path>-quarantine-<ts>,
+//      - When clean local commits are strictly ahead, push them to origin.
+//        If that push fails or the branch is genuinely diverged, quarantine:
+//        rename worktree to <path>-quarantine-<ts>,
 //        prune git's stale metadata, back up the local branch HEAD to
 //        refs/minions/quarantine/<sanitized>/<ts>, reset
 //        refs/heads/<branch> → origin/<branch>, and write a notes/inbox/
@@ -1458,6 +1506,124 @@ const _quarantinePathLocks = new Map();
 //      quarantined, quarantinedPath, backupRef } so the caller can fail
 //      fast with a first-class DIRTY_WORKTREE / WORKTREE_DIRTY /
 //      WORKTREE_DIVERGENT reason and retry semantics.
+async function pushCleanAheadBranch({ rootDir, worktreePath, branchName, mainBranch, project, gitOpts = {} } = {}) {
+  const result = { pushed: false, reason: null, ahead: 0, behind: 0 };
+  if (!rootDir || !worktreePath || !branchName || !fs.existsSync(worktreePath)) {
+    return { ...result, reason: 'invalid-worktree' };
+  }
+  if (mainBranch && sanitizeBranch(branchName) === sanitizeBranch(mainBranch)) {
+    return { ...result, reason: 'main-branch' };
+  }
+  const { gitExtraArgs: _staleGitExtraArgs, ...networkGitOpts } = gitOpts;
+  const runNetworkGit = (args, opts) => project
+    ? adoGitAuth.runAdoGit(project, args, { ...networkGitOpts, ...opts })
+    : shared.shellSafeGit(args, { ...gitOpts, ...opts });
+  try {
+    const current = String(await shared.shellSafeGit(
+      ['symbolic-ref', '--quiet', '--short', 'HEAD'],
+      { ...gitOpts, cwd: worktreePath, timeout: 10000 },
+    ) || '').trim();
+    if (current !== branchName) return { ...result, reason: 'branch-mismatch' };
+
+    const status = String(await shared.shellSafeGit(
+      ['--no-optional-locks', 'status', '--porcelain'],
+      { ...gitOpts, cwd: worktreePath, timeout: 15000 },
+    ) || '').split(/\r?\n/).map(line => line.trim()).filter(Boolean)
+      .filter(line => !shared.isWorktreeOwnerMarkerStatusLine(line));
+    if (status.length > 0) return { ...result, reason: 'dirty' };
+
+    let remoteExists = false;
+    let trackingRefExists = false;
+    try {
+      await shared.shellSafeGit(
+        ['show-ref', '--verify', '--quiet', `refs/remotes/origin/${branchName}`],
+        { ...gitOpts, cwd: rootDir, timeout: 10000 },
+      );
+      remoteExists = true;
+      trackingRefExists = true;
+    } catch {
+      // A first-attempt branch may not have a local remote-tracking ref. Only
+      // pay for ls-remote in that uncommon case; aligned dispatch closes stay
+      // local-only and do not add a network round trip.
+      try {
+        const remote = String(await runNetworkGit(
+          ['ls-remote', '--exit-code', '--heads', 'origin', branchName],
+          { cwd: rootDir, timeout: 15000 },
+        ) || '').trim();
+        remoteExists = !!remote;
+      } catch (err) {
+        if (err?.code !== 2 && err?.status !== 2) {
+          return { ...result, reason: 'remote-probe-failed', error: err.message };
+        }
+      }
+    }
+
+    if (remoteExists) {
+      if (trackingRefExists) {
+        const localCounts = String(await shared.shellSafeGit(
+          ['rev-list', '--left-right', '--count', `refs/remotes/origin/${branchName}...HEAD`],
+          { ...gitOpts, cwd: worktreePath, timeout: 15000 },
+        ) || '').trim().split(/\s+/).map(Number);
+        const locallyAhead = Number.isFinite(localCounts[1]) ? localCounts[1] : 0;
+        if (locallyAhead === 0) {
+          return {
+            ...result,
+            behind: Number.isFinite(localCounts[0]) ? localCounts[0] : 0,
+            reason: 'aligned',
+          };
+        }
+      }
+      try {
+        await runNetworkGit(
+          ['fetch', 'origin', branchName],
+          { cwd: rootDir, timeout: 30000 },
+        );
+      } catch (err) {
+        return { ...result, reason: 'fetch-failed', error: err.message };
+      }
+      const counts = String(await shared.shellSafeGit(
+        ['rev-list', '--left-right', '--count', `refs/remotes/origin/${branchName}...HEAD`],
+        { ...gitOpts, cwd: worktreePath, timeout: 15000 },
+      ) || '').trim().split(/\s+/).map(Number);
+      result.behind = Number.isFinite(counts[0]) ? counts[0] : 0;
+      result.ahead = Number.isFinite(counts[1]) ? counts[1] : 0;
+      if (result.behind > 0) return { ...result, reason: 'diverged' };
+      if (result.ahead === 0) return { ...result, reason: 'aligned' };
+    } else {
+      if (!mainBranch) return { ...result, reason: 'no-upstream-no-main' };
+      try {
+        result.ahead = Number(String(await shared.shellSafeGit(
+          ['rev-list', '--count', `refs/remotes/origin/${mainBranch}..HEAD`],
+          { ...gitOpts, cwd: worktreePath, timeout: 15000 },
+        ) || '').trim());
+      } catch (err) {
+        return { ...result, reason: 'main-compare-failed', error: err.message };
+      }
+      if (!Number.isFinite(result.ahead) || result.ahead <= 0) {
+        return { ...result, ahead: 0, reason: 'no-local-commits' };
+      }
+    }
+
+    try {
+      await runNetworkGit(
+        ['push', 'origin', `HEAD:refs/heads/${branchName}`],
+        { cwd: worktreePath, timeout: 30000 },
+      );
+      log('info', `Preserved ${result.ahead} clean local commit(s) by pushing ${branchName} to origin`);
+      return {
+        ...result,
+        pushed: true,
+        reason: remoteExists ? 'pushed-ahead' : 'pushed-new-branch',
+      };
+    } catch (err) {
+      log('warn', `Failed to preserve clean ahead branch ${branchName}: ${err.message}`);
+      return { ...result, reason: 'push-failed', error: err.message };
+    }
+  } catch (err) {
+    return { ...result, reason: 'probe-failed', error: err.message };
+  }
+}
+
 async function assertCleanSharedWorktree(rootDir, worktreePath, branchName, dispatchId, gitOpts = {}, opts = {}) {
   const quarantineOnUnsafe = !!opts.quarantineOnUnsafe;
   // W-mq1habhf: status probe timeout is now configurable so large/GVFS repos
@@ -1638,6 +1804,41 @@ async function assertCleanSharedWorktree(rootDir, worktreePath, branchName, disp
     }
   }
 
+  // #853 — a clean branch that is strictly ahead contains completed agent
+  // commits, not contamination. Preserve them on the PR/work branch before
+  // quarantine can move the work to a local-only backup ref. A rejected or
+  // non-fast-forward push falls through to the existing quarantine path.
+  if (!filesystemDirty && quarantineOnUnsafe && (result.ahead > 0 || !upstreamKnown)) {
+    const preservation = await pushCleanAheadBranch({
+      rootDir,
+      worktreePath,
+      branchName,
+      mainBranch: opts.mainBranch,
+      project: opts.project,
+      gitOpts,
+    });
+    const preservationProvedClean = preservation.pushed ||
+      ['aligned', 'no-local-commits'].includes(preservation.reason);
+    if (preservationProvedClean) {
+      result.clean = true;
+      result.pushed = preservation.pushed;
+      result.ahead = preservation.ahead;
+      result.behind = preservation.behind;
+      result.reason = preservation.reason;
+      return result;
+    }
+    result.pushFailure = preservation.reason;
+    result.pushError = preservation.error;
+    if (preservation.reason !== 'diverged') {
+      // A network/auth failure does not prove the branch is unsafe. Leave the
+      // clean ahead worktree intact so a later retry can push the same commits.
+      result.reason = preservation.reason;
+      return result;
+    }
+    result.ahead = preservation.ahead;
+    result.behind = preservation.behind;
+  }
+
   // 5. Unpushed-commit check — refuse to reset when local work would be lost.
   //    Use the ahead count we already computed (cheaper + correct vs.
   //    `git log @{u}..HEAD` which needs an upstream config and silently
@@ -2162,7 +2363,6 @@ async function spawnAgent(dispatchItem, config) {
   // (large prompts are written to engine/contexts/<id>.md to keep dispatch rows
   // small — see shared.sidecarDispatchPrompt / #1167).
   let taskPrompt = shared.resolveDispatchPrompt(dispatchItem);
-  const claudeConfig = config.claude || {};
   const engineConfig = config.engine || {};
   const startedAt = ts();
   // Phase timing — raw timestamps, emitted as one structured `[spawn-timing]`
@@ -2430,6 +2630,28 @@ async function spawnAgent(dispatchItem, config) {
     });
   } catch (e) { log('warn', `spawnAgent: failed to persist tmpDir for ${id}: ${e.message}`); }
   const _cleanupPromptFiles = () => { shared.removeDispatchTmpDir(dispatchTmpDir); };
+  const _failWorktreeRemotePreparation = (remoteErr, reasonContext, unavailableContext) => {
+    const classificationErr = remoteErr?._probeFailed && remoteErr._cause
+      ? remoteErr._cause
+      : remoteErr;
+    const failureClass = _classifyFreshBaseFetchFailure(classificationErr);
+    const safeRemoteError = adoGitAuth.redactBearer(String(remoteErr?.message || remoteErr));
+    const reason = `${failureClass.toUpperCase().replace(/-/g, '_')}: ${reasonContext}: ${safeRemoteError}`;
+    log('error', `spawnAgent: ${reason}`);
+    _cleanupPromptFiles();
+    completeDispatch(
+      id,
+      DISPATCH_RESULT.ERROR,
+      reason.slice(0, 800),
+      `No worktree or agent was started. The work item remains retryable and will not count against the selected agent because ${unavailableContext}.`,
+      {
+        failureClass,
+        agentRetryable: true,
+        countAgentRetryFailure: false,
+      },
+    );
+    cleanupTempAgent(agentId);
+  };
   // Convert a WORKTREE_NESTED_IN_PROJECT throw into a fail-fast non-retryable
   // dispatch failure (W-mp62taw2000ubcc3). The error's `.code` is set by
   // shared.assertWorktreeOutsideProject so we don't have to parse the message.
@@ -3506,7 +3728,17 @@ async function spawnAgent(dispatchItem, config) {
             // ahead of main) — two consecutive fix dispatches errored on
             // STALE_HEAD over 10 min and the engine then starved the PR for
             // the cooldown window (60 min effective).
-            const _branchOnRemote = await probeBranchOnRemote(rootDir, branchName, _gitOpts);
+            let _branchOnRemote;
+            try {
+              _branchOnRemote = await probeBranchOnRemote(rootDir, branchName, _gitOpts);
+            } catch (probeErr) {
+              _failWorktreeRemotePreparation(
+                probeErr,
+                `could not determine whether origin has branch ${branchName}`,
+                `its required origin/${branchName} existence check could not complete`,
+              );
+              return null;
+            }
 
             if (_branchOnRemote) {
               // Mirror shared-branch fetch+add (~line 1157-1159).
@@ -3556,7 +3788,7 @@ async function spawnAgent(dispatchItem, config) {
                 } else { throw eRemote; }
               }
             } else {
-              // Branch isn't on origin (or probe failed) — start a fresh local
+              // Branch is confirmed absent on origin — start a fresh local
               // branch from origin/<mainRef>. This is the dominant path for new
               // implement/decompose dispatches.
               // W-mph6n4p00006ce38: mirror the pool-borrow path (~line 1110-1114)
@@ -3564,17 +3796,33 @@ async function spawnAgent(dispatchItem, config) {
               // not the local ref. Without this, fresh-create dispatches inherit
               // whatever stale local master the engine clone happens to be on
               // (most painful: long-lived engine processes between restarts).
-              // Non-fatal: if the fetch fails (network blip, transient auth),
-              // fall back to local mainRef so the dispatch still progresses;
-              // the dep-merge phase's own fetch + the on-failure
-              // `git reset --hard origin/<mainRef>` recovery remain as safety nets.
+              // Fail closed: an ordinary brand-new branch must never inherit a
+              // stale local mainRef when origin/<mainRef> could not be refreshed.
+              // Existing/PR/shared branches are handled above and retain their
+              // continuation semantics.
+              // A local branch with no upstream is an intentional retry/WIP
+              // continuation. Preserve the old `-b` -> "already exists" fallback
+              // below; only truly brand-new branches require a fresh base.
+              const _branchExistsLocally = await _probeBranchLocally(rootDir, branchName, _gitOpts);
               let _freshCreateBase = mainRef;
-              const _baseFetchOk = await _fetchWithTransientRetry(
-                ['origin', mainRef],
-                { ..._gitOpts, cwd: rootDir, timeout: 30000 },
-                `origin/${mainRef} (fresh-create base for ${branchName})`
-              );
-              if (_baseFetchOk) _freshCreateBase = `origin/${mainRef}`;
+              if (!_branchExistsLocally) {
+                try {
+                  await _fetchWithTransientRetry(
+                    ['origin', mainRef],
+                    { ..._gitOpts, cwd: rootDir, timeout: 30000 },
+                    `origin/${mainRef} (fresh-create base for ${branchName})`,
+                    { throwOnFailure: true },
+                  );
+                  _freshCreateBase = `origin/${mainRef}`;
+                } catch (freshBaseErr) {
+                  _failWorktreeRemotePreparation(
+                    freshBaseErr,
+                    `could not refresh origin/${mainRef} before creating brand-new branch ${branchName}`,
+                    `its required fresh origin/${mainRef} base was unavailable`,
+                  );
+                  return null;
+                }
+              }
               try {
                 await runWorktreeAdd(rootDir, worktreePath, ['-b', branchName, _freshCreateBase], _worktreeGitOpts, worktreeCreateRetries);
               } catch (e1) {
@@ -3787,12 +4035,14 @@ async function spawnAgent(dispatchItem, config) {
         {
           quarantineOnUnsafe: true,
           mainBranch: shared.resolveMainBranch(rootDir, project.mainBranch),
+          project,
           statusTimeoutMs: engineConfig.assertCleanStatusTimeoutMs ?? ENGINE_DEFAULTS.assertCleanStatusTimeoutMs,
         },
       );
       _phaseT.dirtyReusedCheckEnd = Date.now();
       if (!cleanResult.clean) {
         const previewFiles = (cleanResult.dirtyFiles || []).slice(0, 5).join(', ');
+        const isPushBlocked = ['remote-probe-failed', 'fetch-failed', 'push-failed'].includes(cleanResult.reason);
         const isDivergent = (cleanResult.ahead || 0) > 0 || cleanResult.reason === 'no-upstream';
         // W-mq1habhf: status-failed is a different beast than
         // has-unpushed-commits / no-upstream. We couldn't even read the
@@ -3815,12 +4065,21 @@ async function spawnAgent(dispatchItem, config) {
         // the existing _quarantineRecoveryCount cap. This stops env failures
         // from burning the per-agent retry budget the way they did before.
         const isQuarantineEnvBlocked = !!(cleanResult.quarantineError && !cleanResult.quarantined);
-        const failureClassValue = isQuarantineEnvBlocked
-          ? FAILURE_CLASS.WORKTREE_QUARANTINE_ENV_BLOCKED
-          : (isDivergent ? FAILURE_CLASS.WORKTREE_DIVERGENT : FAILURE_CLASS.WORKTREE_DIRTY);
-        const failureClassName = isQuarantineEnvBlocked
-          ? 'WORKTREE_QUARANTINE_ENV_BLOCKED'
-          : (isDivergent ? 'WORKTREE_DIVERGENT' : 'WORKTREE_DIRTY');
+        const isPushAuthBlocked = isPushBlocked && adoGitAuth.isAdoAuthFailure(
+          new Error(cleanResult.pushError || ''),
+        );
+        let failureClassValue = FAILURE_CLASS.WORKTREE_DIRTY;
+        let failureClassName = 'WORKTREE_DIRTY';
+        if (isPushBlocked) {
+          failureClassValue = isPushAuthBlocked ? FAILURE_CLASS.AUTH : FAILURE_CLASS.NETWORK_ERROR;
+          failureClassName = isPushAuthBlocked ? 'AUTH' : 'NETWORK_ERROR';
+        } else if (isQuarantineEnvBlocked) {
+          failureClassValue = FAILURE_CLASS.WORKTREE_QUARANTINE_ENV_BLOCKED;
+          failureClassName = 'WORKTREE_QUARANTINE_ENV_BLOCKED';
+        } else if (isDivergent) {
+          failureClassValue = FAILURE_CLASS.WORKTREE_DIVERGENT;
+          failureClassName = 'WORKTREE_DIVERGENT';
+        }
         // #284: distinguish the ORIGINAL worktree-preflight failure from a
         // failure on the automatic fresh-worktree retry. The quarantine
         // auto-recovery loop (discoverFromWorkItems) flips a failed
@@ -3833,7 +4092,9 @@ async function spawnAgent(dispatchItem, config) {
         const retryLabel = priorQuarantineRetry > 0
           ? ` [retry-in-fresh-worktree #${priorQuarantineRetry} also failed]`
           : ' [original worktree-preflight issue]';
-        const reasonMsg = cleanResult.quarantined
+        const reasonMsg = isPushBlocked
+          ? `${failureClassName}: clean ahead worktree at ${worktreePath} could not be pushed (${cleanResult.reason}: ${cleanResult.pushError || 'unknown error'}). The worktree and local commits were preserved for retry.`
+          : cleanResult.quarantined
           ? `${failureClassName}: reused worktree at ${worktreePath} was dirty/divergent (${cleanResult.reason}; ${cleanResult.ahead || 0} ahead, ${cleanResult.behind || 0} behind, ${cleanResult.dirtyFiles?.length || 0} dirty file(s)${previewFiles ? ': ' + previewFiles : ''}) — quarantined to ${cleanResult.quarantinedPath}. Next dispatch will start fresh.`
           : `${failureClassName}: reused worktree at ${worktreePath} is dirty/divergent (${cleanResult.reason}; ${cleanResult.ahead || 0} ahead, ${cleanResult.behind || 0} behind, ${cleanResult.dirtyFiles?.length || 0} file(s)${previewFiles ? ': ' + previewFiles : ''}). Quarantine ${cleanResult.quarantineError ? 'errored: ' + cleanResult.quarantineError : (cleanResult.quarantineSkipped ? 'was skipped — another live dispatch claims the worktree (see notes/inbox/ engine-worktree-skip-live note).' : 'was not attempted (' + cleanResult.reason + ').')}`;
         log('error', reasonMsg);
@@ -3843,7 +4104,11 @@ async function spawnAgent(dispatchItem, config) {
           DISPATCH_RESULT.ERROR,
           reasonMsg.slice(0, 500),
           `Engine preflight refused to dispatch into a dirty/divergent reused worktree (#2996).${retryLabel} Reason: ${cleanResult.reason}.${cleanResult.quarantined ? ` Worktree quarantined to ${cleanResult.quarantinedPath}; backup ref ${cleanResult.backupRef || '(skipped)'}. See notes/inbox/ for recovery instructions.` : (cleanResult.quarantineSkipped ? ' Quarantine was skipped because another live dispatch claims this worktree path; this dispatch will not auto-retry until the live claimant clears.' : '')}${isQuarantineEnvBlocked ? ' Environmental quarantine failure (Windows EBUSY); WI auto-recovery loop will re-queue without bumping per-agent retry counter.' : ''}`,
-          { agentRetryable: isStatusProbeFailed && cleanResult.quarantined, failureClass: failureClassValue },
+          {
+            agentRetryable: (isStatusProbeFailed && cleanResult.quarantined) ||
+              (isPushBlocked && !isPushAuthBlocked),
+            failureClass: failureClassValue,
+          },
         );
         cleanupTempAgent(agentId);
         return null;
@@ -4455,11 +4720,8 @@ async function spawnAgent(dispatchItem, config) {
   const resolvedModel = runtime.resolveModel(shared.resolveAgentModel(agentConfig, engineConfig));
   const resolvedMaxBudget = shared.resolveAgentMaxBudget(agentConfig, engineConfig);
   const resolvedBare = shared.resolveAgentBareMode(agentConfig, engineConfig);
-  // P-1d8f0b93 — pool a copilot dispatch through the persistent ACP worker
-  // pool (engine/agent-worker-pool.js) instead of cold-spawning a fresh CLI
-  // process, when the capability + config gate allows it. Structurally
-  // copilot-only (runtime.capabilities.acpWorkerPool) — see
-  // shared.resolveAgentUseWorkerPool for the exact precedence chain.
+  // Pool through the persistent ACP worker transport when the selected adapter
+  // opts into that capability and config allows it.
   const useAgentPool = shared.resolveAgentUseWorkerPool(engineConfig, runtime);
   if (useAgentPool) {
     // Idempotent — cheap to call on every pooled dispatch so a live config
@@ -4468,27 +4730,7 @@ async function spawnAgent(dispatchItem, config) {
     agentWorkerPool.setPoolSize(shared.resolveAgentAcpPoolSize(engineConfig));
   }
 
-  // W-mpg6isvy000xca4d — On retry after FAILURE_CLASS.MODEL_UNAVAILABLE, swap
-  // to the runtime-appropriate fallback model. Two paths gated on
-  // `runtime.capabilities.fallbackModel` (no `runtime.name === ...` branches):
-  //   - Capability TRUE (Claude): the CLI's own --fallback-model handles
-  //     the swap on 429. We keep `engineConfig.claudeFallbackModel` plumbed
-  //     unconditionally via the fallbackModel opt below; no model override
-  //     needed at the engine layer.
-  //   - Capability FALSE (Copilot): no --fallback-model flag exists, so we
-  //     OVERRIDE the --model arg directly with engine.copilotFallbackModel
-  //     for this retry attempt only. The work item's _lastFailureClass is
-  //     written by dispatch.js's retry block; the next normal dispatch loop
-  //     pick-up re-reads it through meta.item.
-  let effectiveModel = resolvedModel;
   const prevFailureClass = meta?.item?._lastFailureClass || null;
-  if (prevFailureClass === FAILURE_CLASS.MODEL_UNAVAILABLE
-      && runtime.capabilities?.fallbackModel === false
-      && engineConfig.copilotFallbackModel) {
-    effectiveModel = engineConfig.copilotFallbackModel;
-    log('info', `MODEL_UNAVAILABLE retry: ${runtimeName} ${id} — overriding --model to ${effectiveModel}`);
-  }
-
   const requestedEffort = engineConfig.agentEffort || null;
 
   let cachedSessionId = null;
@@ -4497,53 +4739,49 @@ async function spawnAgent(dispatchItem, config) {
       agentId,
       branchName,
       agentsDir: AGENTS_DIR,
-      // Pass the working directory so the Claude adapter can probe for the
-      // conversation jsonl and avoid `--resume <dead-uuid>` retry loops when
-      // the agent died before checkpoint (W-mouugzow00068741).
+      // Adapters may use cwd to verify that their backing session still exists
+      // before returning a resumable ID.
       cwd,
       logger: _runtimeLogger(),
     });
   }
 
-  const args = _buildAgentSpawnFlags(runtime, {
-    model: effectiveModel,
+  const runtimeOptions = resolveInvocationOptions(runtime, {
+    model: resolvedModel,
     maxTurns: _maxTurnsForType(type, engineConfig),
-    allowedTools: shared.mergeManifestAllowedTools(
-      claudeConfig.allowedTools,
-      shared.resolveAgentManifest(_manifestAgent).allowed_tools,
-    ),
+    allowedTools: shared.resolveAgentAllowedTools(config),
     effort: requestedEffort,
     sessionId: cachedSessionId,
     maxBudget: resolvedMaxBudget,
     bare: resolvedBare,
-    fallbackModel: engineConfig.claudeFallbackModel,
-    stream: engineConfig.copilotStreamMode,
-    disableBuiltinMcps: engineConfig.copilotDisableBuiltinMcps,
-    reasoningSummaries: engineConfig.copilotReasoningSummaries,
+  }, {
+    config,
+    engineConfig,
+    failureClass: prevFailureClass,
   });
+  runtimeOptions.allowedTools = shared.mergeManifestAllowedTools(
+    runtimeOptions.allowedTools,
+    shared.resolveAgentManifest(_manifestAgent).allowed_tools,
+  );
+  const effectiveModel = runtimeOptions.model;
+  if (prevFailureClass === FAILURE_CLASS.MODEL_UNAVAILABLE
+      && effectiveModel && effectiveModel !== resolvedModel) {
+    log('info', `MODEL_UNAVAILABLE retry: ${runtimeName} ${id} — adapter selected model ${effectiveModel}`);
+  }
+  const args = _buildAgentSpawnFlags(runtime, runtimeOptions);
 
-  // MCP servers: agents inherit from ~/.claude.json directly as Claude Code processes.
-  // No --mcp-config needed — avoids redundant config and ensures agents always have latest servers.
-  //
-  // P-7d31a06b — When the runtime is Claude AND the worktree has a `.mcp.json`,
-  // pre-warm `~/.claude.json` projects.<worktreePath>.enabledMcpjsonServers so
-  // Claude's first call doesn't show the project-MCP trust prompt (which
-  // --dangerously-skip-permissions silently suppresses → agent runs without the
-  // workspace MCPs connected). Helper internally no-ops for non-Claude runtimes
-  // and when engine.claudePreApproveWorkspaceMcps is false (no runtime.name
-  // check at this call site, per CLAUDE.md rule). Best-effort: NEVER block dispatch.
-  //
+  // Let the adapter prepare any runtime-owned workspace state. Best-effort:
+  // harness setup must never block dispatch.
   try {
-    const result = preApproveWorkspaceMcps({
-      runtimeName,
+    const result = prepareWorkspace(runtime, {
       worktreePath,
       homeDir: os.homedir(),
       engineConfig,
       mutateJsonFileLocked: shared.mutateJsonFileLocked,
     });
     if (result.wrote) {
-      log('info', `Pre-approved ${result.servers.length} workspace MCP server(s) in ~/.claude.json for ${worktreePath}: ${result.servers.join(', ')}`);
-    } else if (result.reason !== 'no-workspace-mcp' && result.reason !== 'not-claude' && result.reason !== 'no-worktree') {
+      log('info', `Runtime workspace prepared for ${id}${result.target ? ` (${result.target})` : ''}`);
+    } else if (result.reason !== 'no-workspace-mcp' && result.reason !== 'unsupported-runtime' && result.reason !== 'no-worktree') {
       log('debug', `Skipped workspace MCP pre-approval for ${id} (reason=${result.reason})`);
     }
   } catch (err) {
@@ -4557,7 +4795,7 @@ async function spawnAgent(dispatchItem, config) {
 
   // Agent status is derived from dispatch state.
 
-  // Spawn the claude process
+  // Spawn the selected harness runtime.
   const childEnv = shared.cleanChildEnv();
   if (completionReportPath) childEnv.MINIONS_COMPLETION_REPORT = completionReportPath;
   if (completionNonce) childEnv.MINIONS_COMPLETION_NONCE = completionNonce;
@@ -4617,7 +4855,7 @@ async function spawnAgent(dispatchItem, config) {
 
   // Spawn via wrapper script — node directly (no bash intermediary)
   // spawn-agent.js handles CLAUDECODE env cleanup and claude binary resolution
-  const spawnScript = path.join(ENGINE_DIR, 'spawn-agent.js');
+  const spawnScript = runtime.spawnScript || path.join(ENGINE_DIR, 'spawn-agent.js');
 
   const spawnArgs = [spawnScript, promptPath, sysPromptPath, ...args];
   // P-1d8f0b93 — the pooled-dispatch branch further down (agentWorkerPool
@@ -4730,6 +4968,7 @@ async function spawnAgent(dispatchItem, config) {
       }
       proc = new PooledAgentProcess({
         pool: agentWorkerPool,
+        runtime,
         dispatchId: id,
         cwd,
         model: effectiveModel,
@@ -4873,7 +5112,7 @@ async function spawnAgent(dispatchItem, config) {
   let stdout = '';
   let stderr = '';
   let steeringAckStdout = '';
-  const sessionCaptureState = { sessionLineBuffer: '' };
+  const sessionCaptureState = { sessionLineBuffer: '', modelLineBuffer: '' };
   let _trustCheckDone = false;
   const _spawnTime = Date.now();
 
@@ -4908,6 +5147,7 @@ async function spawnAgent(dispatchItem, config) {
     // Copilot emits sessionId, so use the runtime-neutral steering helper.
     const procInfo = activeProcesses.get(id);
     markRuntimeResumeOutputSeen(procInfo);
+    captureExecutionModelFromStdoutChunk(dispatchItem, id, runtime, procInfo, chunk, sessionCaptureState);
     captureSessionIdFromStdoutChunk(agentId, id, branchName, runtime, procInfo, chunk, sessionCaptureState);
 
     ackPendingSteeringFiles(agentId, procInfo, chunk);
@@ -4943,6 +5183,25 @@ async function spawnAgent(dispatchItem, config) {
     ackPendingSteeringFiles(agentId, procInfo, steeringAckStdout);
     promoteCheckpointSteeringForClose(agentId, procInfo, runtime, liveOutputPath);
 
+    // #853 — the child is gone, so its clean committed state is stable. Push
+    // any strictly-ahead dispatch branch before steering resume, pool return,
+    // quarantine, or dispatch-end GC can detach/remove the worktree.
+    const branchPath = worktreePath || (liveMode ? project?.localPath : null);
+    const branchRootDir = liveMode ? project?.localPath : rootDir;
+    if (branchPath && branchRootDir && branchName && fs.existsSync(branchPath)) {
+      const preservation = await pushCleanAheadBranch({
+        rootDir: branchRootDir,
+        worktreePath: branchPath,
+        branchName,
+        mainBranch: shared.resolveMainBranch(branchRootDir, project?.mainBranch),
+        project,
+        gitOpts: _gitOpts,
+      });
+      if (!preservation.pushed && !['aligned', 'dirty', 'no-local-commits'].includes(preservation.reason)) {
+        log('warn', `Dispatch-close branch preservation skipped for ${id}: ${preservation.reason}`);
+      }
+    }
+
     // Check if this was a steering kill — re-spawn with resume
     if (procInfo?._steeringMessage) {
       const steerMsg = procInfo._steeringMessage;
@@ -5010,22 +5269,17 @@ async function spawnAgent(dispatchItem, config) {
         return;
       }
 
-      const resumeArgs = _buildAgentSpawnFlags(runtime, {
-        model: effectiveModel,
+      const resumeRuntimeOptions = resolveInvocationOptions(runtime, {
+        ...runtimeOptions,
         maxTurns: engineConfig?.maxTurns || ENGINE_DEFAULTS.maxTurns,
-        allowedTools: shared.mergeManifestAllowedTools(
-          claudeConfig?.allowedTools,
-          shared.resolveAgentManifest(_manifestAgent).allowed_tools,
-        ),
         sessionId: steerSessionId,
-        maxBudget: resolvedMaxBudget,
-        bare: resolvedBare,
-        fallbackModel: engineConfig?.claudeFallbackModel,
-        stream: engineConfig?.copilotStreamMode,
-        disableBuiltinMcps: engineConfig?.copilotDisableBuiltinMcps,
-        reasoningSummaries: engineConfig?.copilotReasoningSummaries,
+      }, {
+        config,
+        engineConfig,
+        failureClass: prevFailureClass,
       });
-      if (!resumeArgs.includes('--resume')) {
+      const resumeArgs = _buildAgentSpawnFlags(runtime, resumeRuntimeOptions);
+      if (runtime.capabilities?.sessionResume !== true) {
         log('warn', `Steering: runtime ${runtime.name} did not accept session resume — skipping for ${agentId}`);
         try { fs.appendFileSync(liveOutputPath, `\n[steering-failed] Runtime ${runtime.name} does not support session resume. Message was: ${steerMsg}\n`); } catch {}
         try { fs.unlinkSync(steerPromptPath); } catch {}
@@ -5035,7 +5289,7 @@ async function spawnAgent(dispatchItem, config) {
         return;
       }
 
-      const spawnScript = path.join(ENGINE_DIR, 'spawn-agent.js');
+      const spawnScript = runtime.spawnScript || path.join(ENGINE_DIR, 'spawn-agent.js');
       const childEnv = shared.cleanChildEnv();
       if (completionReportPath) childEnv.MINIONS_COMPLETION_REPORT = completionReportPath;
       // P-d2a8f6c1: preserve the per-dispatch nonce across steering resume so
@@ -5132,6 +5386,7 @@ async function spawnAgent(dispatchItem, config) {
         stderr = '';
       }
       sessionCaptureState.sessionLineBuffer = '';
+      sessionCaptureState.modelLineBuffer = '';
       // Re-wire stdout/stderr handlers (same as original)
       resumeProc.stdout.on('data', (data) => {
         const chunk = data.toString();
@@ -5159,6 +5414,7 @@ async function spawnAgent(dispatchItem, config) {
           } catch { /* best-effort */ }
         }
         markRuntimeResumeOutputSeen(resumeInfo);
+        captureExecutionModelFromStdoutChunk(dispatchItem, id, runtime, resumeInfo, chunk, sessionCaptureState);
         captureSessionIdFromStdoutChunk(agentId, id, branchName, runtime, resumeInfo, chunk, sessionCaptureState);
         ackPendingSteeringFiles(agentId, resumeInfo, chunk);
       });
@@ -5272,7 +5528,7 @@ async function spawnAgent(dispatchItem, config) {
     // delete clears the entry.
     const expectedNonce = activeProcesses.get(id)?._completionNonce || null;
     const completionNonceRequired = engineConfig.completionNonceRequired ?? ENGINE_DEFAULTS.completionNonceRequired;
-    const { resultSummary, autoRecovered, completionContractFailure, structuredCompletion, agentReportedFailure, agentRetryable, nonceMismatch } = await runPostCompletionHooks(dispatchItem, agentId, code, stdout, config, { expectedNonce, completionNonceRequired });
+    const { resultSummary, autoRecovered, completionContractFailure, structuredCompletion, agentReportedFailure, agentRetryable, nonceMismatch, benignNoop } = await runPostCompletionHooks(dispatchItem, agentId, code, stdout, config, { expectedNonce, completionNonceRequired });
     const retryableDecision = typeof agentRetryable === 'boolean' ? agentRetryable : failureInfo.retryable;
 
     // W-mp6k7ywi000fa33c — keep_processes acceptance gate. When the work
@@ -5678,7 +5934,7 @@ async function spawnAgent(dispatchItem, config) {
     const managedSpawnHealthcheckFail = !!managedSpawnHealthcheckFailure;
     const effectiveResult = (hardContractFail || nonceFail || keepProcessesAcceptanceFail || managedSpawnAcceptanceFail || managedSpawnHealthcheckFail)
       ? DISPATCH_RESULT.ERROR
-      : (((code === 0 && !agentReportedFailure) || autoRecovered) ? DISPATCH_RESULT.SUCCESS : DISPATCH_RESULT.ERROR);
+      : (((code === 0 && !agentReportedFailure) || autoRecovered || benignNoop) ? DISPATCH_RESULT.SUCCESS : DISPATCH_RESULT.ERROR);
     const finalCompletionReportPath = structuredCompletion?._path || dispatchItem.meta?.completionReportPath || shared.dispatchCompletionReportPath(id);
     const completionOpts = {
       ...(finalCompletionReportPath ? { completionReportPath: finalCompletionReportPath } : {}),
@@ -6070,6 +6326,10 @@ async function spawnAgent(dispatchItem, config) {
     // route output parsing through the right adapter. Also surfaces the choice
     // in dispatch state for debugging multi-runtime fleets.
     item.runtimeName = runtimeName;
+    if (effectiveModel) item.requestedModel = effectiveModel;
+    else delete item.requestedModel;
+    if (dispatchItem.executionModel) item.executionModel = dispatchItem.executionModel;
+    else delete item.executionModel;
     // P-3f5b7d26 — persist pooled on the DISK record (activeProcesses/_pooled
     // is wiped on restart); cli.js's reattach path needs this since a pooled
     // ACP worker isn't spawned detached and a fresh pool cold-starts empty —
@@ -7801,6 +8061,7 @@ async function discoverFromPrs(config, project) {
             const item = buildPrDispatch(agentId, config, project, pr, 'fix', {
               pr_id: pr.id, pr_branch: prBranch,
               review_note: pr.minionsReview?.note || pr.reviewNote || 'See PR thread comments',
+              review_finding_id: shared.prReviewFindingIdentity(pr),
             }, `Fix ${pr.id}: ${pr.title || ''} — review feedback`, {
               dispatchKey: key, cooldownKey: key, automationCauseKey: reviewCauseKey, source: 'pr', pr, branch: prBranch, project: projMeta,
               // W-mpg58wv3 — closure-loop binding. Carries the originating minion review
@@ -8174,6 +8435,35 @@ function _buildRunnerBriefVars(item, project) {
 /**
  * Scan a project work-item scope for manually queued tasks.
  */
+/**
+ * W-mrdon0pe000l045a — collect directory/file path hints for CLAUDE.md
+ * propagation. These are the paths most relevant to a dispatch; the
+ * CLAUDE.md-context module walks UP from each toward the project root collecting
+ * the nearest applicable CLAUDE.md files. Sources (best-effort, cheap):
+ *   - item.meta.workdir (explicit sub-project directory)
+ *   - item.references[*].path (changed/relevant files)
+ * Returns a de-duplicated array of repo-relative path strings. Empty when no
+ * hints exist — the module still falls back to the project-root CLAUDE.md.
+ */
+function _deriveClaudeMdPathHints(item) {
+  const hints = [];
+  const seen = new Set();
+  const add = (p) => {
+    if (typeof p !== 'string') return;
+    const v = p.trim();
+    if (!v || seen.has(v)) return;
+    seen.add(v);
+    hints.push(v);
+  };
+  if (item && item.meta && typeof item.meta.workdir === 'string') add(item.meta.workdir);
+  if (item && Array.isArray(item.references)) {
+    for (const r of item.references) {
+      if (r && typeof r.path === 'string') add(r.path);
+    }
+  }
+  return hints;
+}
+
 function renderProjectWorkItemPromptForAgent(item, workType, agentId, config, project, root, branchName, options = {}) {
   const worktreePath = options.worktreePath || path.resolve(root, config.engine?.worktreeRoot || '../worktrees', `${branchName}`);
   const vars = {
@@ -8327,6 +8617,14 @@ function renderProjectWorkItemPromptForAgent(item, workType, agentId, config, pr
     // failure via the qa-session-draft-failed / qa-session-execute-failed
     // path. (See playbooks/qa-session-draft.md → "Failure path" section.)
     ..._buildRunnerBriefVars(item, project),
+    // W-mrdon0pe000l045a — CLAUDE.md propagation context for non-Claude runtimes.
+    // renderPlaybook resolves the runtime capability + config flag and, when the
+    // runtime doesn't auto-load CLAUDE.md (Copilot/Codex), bounded-discovers the
+    // nearest applicable CLAUDE.md files walking up from these path hints toward
+    // the project root. runtime_cli lets renderPlaybook check the adapter's
+    // claudeMdNativeDiscovery capability without re-resolving the agent config.
+    runtime_cli: shared.resolveAgentCli(config.agents?.[agentId] || null, config.engine),
+    claude_md_path_hints: _deriveClaudeMdPathHints(item),
     // M006 — typed handoff envelope. Set on follow-up dispatch metas by
     // lifecycle.js when queuing an item after a completing agent. The
     // renderPlaybook path injects a "Handoff Context" section when truthy
@@ -8571,6 +8869,15 @@ function discoverFromWorkItems(config, project) {
     }
 
     if (item.status !== WI_STATUS.QUEUED && item.status !== WI_STATUS.PENDING) continue;
+    if (item._preDispatchEval?.exhausted === true
+        && item._preDispatchEval.description === String(item.description || '')) {
+      if (item._pendingReason !== 'pre_dispatch_eval_rejected') {
+        item._pendingReason = 'pre_dispatch_eval_rejected';
+        needsWrite = true;
+      }
+      skipped.gated++;
+      continue;
+    }
 
     // Dependency gate: skip items whose depends_on are not yet met; propagate failure
     if (item.depends_on && item.depends_on.length > 0) {
@@ -11396,13 +11703,15 @@ module.exports = {
   gitOutputToString, gitErrorOutput, classifyDepMergeFailureOutput, listUnmergedFiles, // exported for testing
   buildDepConflictFixItem, deriveConflictFixKey, // exported for testing (W-mpcwojgr000a0244)
   runWorktreeAdd, // exported for testing (W-mqvaxv65000m76f2 — GVFS partial-checkout behavioral test)
-  isWorktreeRetryableError, removeStaleIndexLock, syncReusedWorktree, assertCleanSharedWorktree, _quarantineDirtyWorktree, // exported for testing
+  _fetchWithTransientRetry, _classifyFreshBaseFetchFailure, _probeBranchLocally, // exported for testing
+  isWorktreeRetryableError, removeStaleIndexLock, syncReusedWorktree, pushCleanAheadBranch, assertCleanSharedWorktree, _quarantineDirtyWorktree, // exported for testing
   _statusPorcelainCmd, _killGitDescendantsForWorktree, _bumpQuarantineOutcome, // exported for testing (W-mq5n1zx5)
   _reapWorktreeHolders, _findTerminalWorktreeOwners, // exported for testing (W-mqila0t5 — CWD-pinned holder reap)
   pruneStaleWorktreeForBranch, // exported for testing
   findExistingWorktree, // exported for testing
   probeBranchOnRemote, // exported for testing (W-mphnm6a1000281b8)
   _maxTurnsForType, buildProjectContext, normalizeAc, _buildAgentSpawnFlags, _classifyAgentFailure, // exported for testing
+  _runtimeModelFromOutputLine, captureExecutionModelFromStdoutChunk, // exported for testing
   _tryAutoResolveLiveCheckoutWorktreeConflict, // exported for testing (W-mr28h2j2000y0de1 review — auto-resolve worktree conflicts)
   _isOutputTruncated, AGENT_OUTPUT_CAP_BYTES, // P-8e4c2a17: exported for testing (OUTPUT_TRUNCATED detection)
   promoteCheckpointSteeringForClose, // exported for testing